PT-2026-58098 · Roundcube · Webmail

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-62644

NVD

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-62644

Affected Products

Webmail

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-62644 · Security Note
• https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.17 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.2 · Note
• https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d · Note
• https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c · Note
• https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476 · Note
• https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2 · Note